Role management
Roles are logical groups within a user pool that differentiate user permissions. You can define roles and assign them to users. Role information is written to the ID Token. Combined with Agent Identity policies, roles allow you to implement role-based access control (RBAC). This topic describes how to create, assign, and delete roles.
Role overview
Roles in a user pool group users and segment their permissions. A role's primary functions are:
Inclusion in the ID Token: When a user logs in, the system writes their assigned roles as a claim to the ID Token issued to the client application.
Policy matching: In an Agent Identity policy statement, you can use a role as a principal condition to implement role-based access control (RBAC). For example, you can allow the
adminrole to perform all actions, while theviewerrole can only perform read-only actions.
Default role
When you create a user pool, the system automatically generates a default role. This default role has the following characteristics:
Automatic assignment: When a new user is created, the system automatically assigns the default role to them. You can unassign the default role after you assign custom roles to the user.
Baseline permissions: You can use the default role to grant basic Agent Identity permissions to all users.
Create a role
Create custom roles for fine-grained control over user permissions.
Log on to the Agent Identity console.
In the left-side navigation pane, choose .
Click the name of the user pool to view its details page.
Click the Roles tab.
Click Create Role.
On the Create Role page, enter a Role Name and an optional Description, and then click Create Role.
Assign a role
Assign roles to users in the user pool. A user can have multiple roles.
From the Roles tab:
In the role list, click the name of the target role.
On the role details page, click .
In the Create Role Assignment dialog box, select the users you want to assign the role to, and then click Create Role Assignment.
From the Users tab:
In the user list, click the name of the target user.
On the user details page, click .
In the Create Role Assignment dialog box, select the roles to assign to the user, and then click Create Role Assignment.
After the assignment is complete, the user's ID Token will include a claim for this role upon their next SSO logon.
Remove a role
To revoke a user's permissions for a specific role, remove that role from the user.
From the Roles tab:
In the role list, click the name of the target role.
On the role details page, click the Role Assignments tab.
In the user list, find the target user and, in the Actions column, click Delete Role Assignment.
In the confirmation dialog box, click OK.
From the Users tab:
In the user list, click the name of the target user.
On the user details page, click the Role Assignments tab.
In the list of assigned roles, find the role that you want to unassign.
In the Actions column, click Delete Role Assignment.
In the confirmation dialog box, click OK.
Delete a role
When a role is no longer needed, you can delete it.
After you delete a role, all users assigned to it lose the associated permissions. The role claim will not appear in their ID Tokens in subsequent logons. This action cannot be undone.
In the role list, find the target role and, in the Actions column, click Delete Role.
In the confirmation dialog box, enter the name of the role to delete, and then click Delete Role.
Role-based access control example
The following example shows how to use roles and policies together to implement RBAC. Assume you have created two roles: admin and viewer.
Add a policy to the policy set that allows users with the
adminrole to perform all actions.Add another policy that allows users with the
viewerrole to perform only read-only actions.